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Office Action Summary 



Application No. 
09/924,391 



Applicant(s) 

Givoly 



Examiner 

Philip B. Tran 



Art Unit 

2155 




- The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE three MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36 (a). In no event, however, rrwy a reply be timely filed after SIX (6) MONTHS from the 
mailing date of this communication. 

• If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent tenii adjustment. See 37 CFR 1 .704(b). 

Status 

1 ) ^ Responsive to communication(s) filed on May 9, 2002 



2a) □ This action is FINAL. 2b) ^ This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1 935 CD. 11; 453 O.G. 213. 

Disposition of Claims 

4) 5<1 Claim(s) 7-23 is/are pending in the application. 

4a) Of the above, claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) S1 Claim(s) 1-23 is/are rejected. 

?)□ Claim(s) is/are objected to. 

8) 0 Claims are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on Aug 7, 2001 is/are a) K accepted or bjD objected to by the Examiner. 
Applicant may not request that any objection to the drawing{s) be held in abeyance. See 37 CFR 1 .85(a). 

I !)□ The proposed drawing correction filed on is: a)n approved bjD disapproved by the Examiner, 

If approved, corrected drawings are required in reply to this Office action. 

12) n The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§ 119 and 120 

13) D Acknowledgement is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some* cjD None of: 

1 . □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
*See the attached detailed Office action for a list of the certified copies not received. 

14) n Acknowledgement is made of a claim for domestic priority under 35 U.S.C. § 1 1 9(e). 
a)D The translation of the foreign language provisional application has been received. 

15) 0 Acknowledgement is made of a claim for domestic priority under 35 U.S.C. §§120 and/or 121. 

Attachment(s) 

II ^ Notice of References Cited (PTO-892) 4) Q Interview Summary (PTO-413) Paper No(s). 

2) CD Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) Q Notice of Informal Patent Application {PTO-1 52) 

3) ^ Infomnation Disclosure Statement(s) tPTO-1449) Paper No(s). ^ 6) O Other: 



U. S. Patent and Tradenvrk Office 

PTO-326 (Rev. 04-01) 
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DETAILED ACTION 



Claim Rejections - 35 USC § 102 



1. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless ~ 

(a) the invention was known or used by others in this country, or patented or described in a printed publication 
in this or a foreign country, before the invention thereof by the applicant for a patent, 

2. Claims 1-23 are rejected under 35 U.S.C. § 102(a) as being anticipated by Deri et al 
(Hereafter, Deri), "Practical Network Security : Experiences with ntop", TERENA Networking 
Conference 22-25 May 2000. 

Regarding claim 1, Deri clearly teaches a method for processing network accounting 
information, comprising : receiving accounting information over a packet-switched network; 
monitoring at least one aspect of the received accounting information; and discarding at least a 
portion of the accounting information based on the monitored aspect (i.e., network traffic 
measurement and monitoring for reporting information about captured packets and detecting 
intrusion for denial of service) [see Pages 1-5]. 

Regarding claim 2, Deri fiirther teaches the method as recited in claim 1, wherein the 
accounting information is discarded for providing a defense against network attacks (i.e., against 
network intruder) [see Page 3]. 
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Regarding claim 3, Deri further teaches the method as recited in claim 1, wherein the 
accounting information is discarded for dealing with heavy network traffic (i.e., analyzing the 
traffic sent/received) [see Page 4]. 

Regarding claim 4, Deri further teaches the method as recited in claim 3, and further 
comprising generating a summary of the accounting information (i.e., reports are done in both 
text and HTML and stored information in the database) [see Pages 3 and 5]. 

Regarding claim 5, Deri further teaches the method as recited in claim 1, wherein 
monitoring the at least one aspect of the received accounting information includes detecting a 
scan of a pluraHty of ports (i.e., scanning ports) [see Pages 3-4]. 

Regarding claim 6, Deri further teaches the method as recited in claim 1, wherein 
monitoring the at least one aspect of the received accounting information includes detecting a 
scan of a plurality of hitemet Protocol (IP) addresses (i.e., detecting IP address) [see Page 4]. 

Regarding claim 7, Deri further teaches the method as recited in claim 1, wherein 
monitoring the at least one aspect of the received accounting information includes monitoring a 
rate of receipt of the accounting information (i.e., monitoring amount of traffic sent/received ) 
[see Pages 3-4]. 



r 
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Regarding claim 8, Deri further teaches the method as recited in claim 7, wherein 
monitoring the at least one aspect of the received accounting information includes detecting 
whether the rate of receipt of the accounting information exceeds a predetermined amount (i.e., 
determining if there is suddenly sent/received amount of traffic) [see Page 4]. 

Regarding claim 9, Deri further teaches the method as recited in claim 1, wherein 
monitoring the at least one aspect of the received accounting information includes monitoring a 
load on a system receiving the accounting information (i.e., counting the traffic and the number 
of connections to any ports) [see Page 4]. 

Regarding claim 10, Deri further teaches the method as recited in claim 1, wherein the 
network includes the Intemet (i.e., ntop is widely used in the network attached to the Intemet) 
[see Pages 1 and 3]. 

Claim 1 1 is rejected under the same rationale set forth above to claim 1 . 
Claims 12-14 are rejected under the same rationale set forth above to claims 2-4, 
respectively. 

Claims 15-18 are rejected under the same rationale set forth above to claims 6-8, 
respectively. 

Claim 18 is rejected under the same rationale set forth above to claim 5. 
Claim 19 is rejected under the same rationale set forth above to claim 9. 
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Claims 20-22 are rejected under the same rationale set forth above to claim 1. 
Claim 23 is rejected under the same rationale set forth above to combination of claims 1 
and 4-9. 

Other References Cited 
3. The following references cited by the examiner but not relied upon are considered 
pertinent to applicant's disclosure. 

A) BuUard et al, U.S. Pat. No. 6,405,251. 

B) Nordenstam et al, U.S. Pat. No. 6,442,615. 

C) Cohen et al, U.S. Pat. No. 6,434,618. 

D) Lindskog et al, U.S. Pat. No. 6,370,572. 
D) Chase et al, U.S. Pat. No. 6,188,671. 
D) Naor et al, U.S. Pat. No. 6,055,508. 

D) Gleichauf et al, U.S. Pat. No. 6,301,668. 



4. A SHORTENED STATUTORY PERIOD FOR RESPONSE TO THIS ACTION IS SET 
TO EXPIRE THREE MONTHS, OR THIRTY DAYS, WHICHEVER IS LONGER, FROM 
THE MAILING DATE OF THIS COMMUNICATION. FAILURE TO RESPOND WITHIN 
THE PERIOD FOR RESPONSE WILL CAUSE THE APPLICATION TO BECOME 
ABANDONED (35 U.S.C. § 133). EXTENSIONS OF TIME MAY BE OBTAINED UNDER 
THE PROVISIONS OF 37 CAR 1.136(A). 
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5. 



Any inquiry concerning this communication or earlier communications from the examiner 



should be directed to Philip Iran whose telephone number is (703) 308-8767. The Group fax 
phone number is (703) 746-7239. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh, can be reached on (703) 305-9648. 

Any inquiry of a general nature or relating to the status of this application should be 
directed to the Group receptionist whose telephone number is (703) 305-3900. 

Philip B. Tran 



Art Unit 2155 
Oct 28, 2002 
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